Elhoim

The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files.

A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade. - Requires prior write access to the database to plant a malicious identifier value - Triggered automatically during a migration or upgrade operation - Can result in unauthorized data disclosure, modification, or deletion Affected versions: flowintel prior to 4.0.0

The `html to markdown` expansion module contains a server-side request forgery (SSRF) issue within the `is safe url()` function. The `BLOCKED RANGES` list used to validate destination addresses was incomplete, failing to block several critical IP ranges including 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. Additionally, IPv4-mapped IPv6 formats bypassed the validation checks. An authenticated user capable of creating or modifying attributes that trigger this module can provide URLs pointing to these internal ranges. Since the server fetches the content to convert HTML to Markdown, it can be abused as a proxy to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that are otherwise inaccessible from external networks.

A logic error exists in the event synchronization process during the preparation of event reports for remote push. The system applies the filtering of non-exportable tags only once after iterating through all reports instead of applying it to each individual report. This leads to the disclosure of restricted tag information to the receiving instance for all reports except the last one. Additionally, if the last report is withheld, a null report is pushed, which prevents the remote instance from saving the event.

An access control flaw exists in the proposal visibility logic for shadow attributes. The authorization check fails to verify the distribution level, allowing any user belonging to a sharing group to view proposals on attributes or objects associated with that group, even when distribution levels 1-3 should restrict such visibility. Additionally, the owning organization is denied access to proposals on its own organization-only attributes. This leads to the unauthorized disclosure of proposed attribute changes.

An authorization flaw exists in the correlation handling during attribute searches. The system grants access to correlated attributes and events using a stale distribution snapshot stored on the correlation row instead of the live event access control list. Since the distribution columns in the correlation row are point-in-time copies lacking a published flag, authorization checks fail when an event is restricted, such as when it is unpublished or its sharing group is modified. This allows an authenticated user with read access to some events to retrieve attributes and event metadata from events they are no longer authorized to view.

Improper access control exists in the attribute search and paginated attribute view endpoints. When an authenticated user with read access to an event owned by another organization queries for soft-deleted attributes, the application discloses those attributes. While the event detail view correctly restricts visibility of soft-deleted attributes to the owning organization and users with sync permissions, the search and paginated view code paths lack this restriction. This can lead to the unauthorized disclosure of sensitive threat intelligence attributes, such as indicators of compromise (IOCs) and context, which the owning organization intended to remove from general visibility.

The `cisco firesight manager ACL rule export` module generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values and MISP attribute values—such as destination IPs, URLs, and event info comments—directly into single-quoted shell string assignments without escaping or sanitization. An attacker can inject arbitrary shell commands by submitting MISP events or attributes containing a single-quote character, which breaks the quoting context. A security analyst executing the resulting script would run these commands with their own privileges, potentially compromising their workstation or exposing fireSIGHT Manager credentials. Additionally, the module contains a defect where the `config` variable is referenced unconditionally despite being assigned only within a conditional block, leading to a NameError and causing a denial of service when the request payload lacks a `config` key.

The LdapAuth and LinOTPAuth authentication plugins contain an authentication bypass. The `LdapAuthenticate` and `LinOTPAuthenticate` functions fail to implement the ` checkFields()` input validation guard, allowing email and password fields from login requests to be processed without verifying they are non-empty strings. In the LDAP authenticator, an empty or null password is sent to `ldap bind()`, which may be accepted as a successful unauthenticated bind by many LDAP directory servers. This allows an attacker with a valid user email address to authenticate without a password. Non-string values may also cause TypeErrors or be misinterpreted in ` findUser()`. In the LinOTP authenticator, non-string credentials can be concatenated into verification requests, and empty passwords may be accepted against stored hashes of empty strings. Additionally, auto-provisioned LDAP accounts may be assigned and store a hash of an empty password, allowing access via mixed-authentication fallback if the user is no longer in LDAP. Exploitation requires the affected plugin to be enabled and knowledge of a valid email address, granting the attacker the full privileges of the impersonated user.

An authorization flaw allows an authenticated user to submit a `sharing group id` without verification of their authorization to use the referenced Sharing Group. In workflows for creating and editing attributes and Galaxy Clusters, validation was only triggered when the distribution field was explicitly set to 4 (Sharing Group). By omitting the distribution parameter or avoiding this specific condition, a user can bypass the authorization check. This enables a user with permissions to create or modify MISP objects to associate data with an unauthorized Sharing Group, potentially bypassing information-sharing boundaries and resulting in the unauthorized distribution of data to other group members.

An incorrect authorization flaw allows authenticated users to delete attributes from events without possessing the required `perm modify` or `perm modify org` permissions. The issue occurs because the `MispAttribute::deleteAttribute()` function performs organization membership checks but fails to consistently enforce event modification authorization rules. This creates a discrepancy where attribute editing is correctly restricted via `ACL::canModifyEvent()`, but deletion operations can bypass these checks. An authenticated attacker who is a member of the organization owning an event can exploit this to remove individual or bulk attributes, leading to unauthorized modification or loss of threat intelligence data.

An improper TLS certificate validation issue exists in the `CurlClient` component. The `CurlClient::$verifyPeer` property was not explicitly initialized, defaulting to null, which effectively disabled TLS peer verification during cURL operations unless explicitly enabled by the calling code. This allows HTTPS connections to accept certificates not issued by a trusted certificate authority. A man-in-the-middle attack could be performed by an attacker capable of intercepting network traffic between a MISP instance and a remote HTTPS service to impersonate the endpoint. This could lead to the observation of sensitive information, such as authentication material and threat intelligence, or the modification of responses returned to the MISP instance.

An authentication bypass exists in the LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom `LdapAuthenticate` and `LinOTPAuthenticate` components failed to replicate the credential validation checks of CakePHP's `FormAuthenticate` implementation, allowing empty or non-string values to reach authentication mechanisms. In the LDAP path, an attacker with a valid directory user's email could submit an empty password; if the LDAP server accepts unauthenticated binds via the `ldap bind()` function, the attacker could impersonate the user. In the LinOTP component, invalid credential types were not rejected, and when mixed authentication was enabled, empty passwords could be validated against local hashes. Additionally, LDAP-provisioned accounts could be created with empty local passwords, allowing authentication via the local fallback mechanism if LDAP resolution failed. Successful exploitation allows a remote unauthenticated attacker to impersonate users, potentially gaining administrative access to sensitive threat-intelligence data and system configurations.

An authorization flaw exists in the OnDemand correlation engine where correlations are calculated based only on matching attribute values, ignoring distribution, sharing group, organization, and other access-control restrictions. This allows an authenticated low-privileged user to receive correlation results for attributes or events they are not authorized to access by querying or creating attributes that correlate with restricted content. The issue stems from the correlation collection path failing to account for the requesting user and the use of potentially stale denormalized access-control information in paths relying on stored correlation data. The system utilizes the `fetchAttributesSimple()` function to evaluate restrictions against live data.

A reflected Cross-Site Scripting (XSS) issue exists in the event attribute filtering query builder. The `taggedAttributes` and `galaxyAttachedAttributes` URL parameters are inserted into query-builder rules without HTML escaping before being serialized as JSON and embedded within a `<script>` element. Because `JsonTool::encode()` uses `JSON UNESCAPED SLASHES`, a value containing a closing `</script>` sequence can terminate the script element and inject arbitrary HTML or JavaScript. An attacker can exploit this by tricking an authenticated user into following a crafted URL, executing malicious JavaScript within the security context of the MISP instance and the victim's session privileges. This may lead to unauthorized data access or modification based on the victim's permissions.